Most recent entries from ossf_malicious_packages

mal-2026-14357

Sat, 22 Aug 2026 00:44:45 +0000

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (8ecbdcebcf83f23f4d19558c398bbc844436d2f2a186be996e8f4a43a70fc860) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

mal-2026-14354

Fri, 21 Aug 2026 16:53:36 +0000

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4) kelly-sizing@0.1.1 ships a postinstall script (install-check.cjs) that fetches a JSON config from pm-trading-dev-tools-be.vercel.app/config/clob-math.json, reads a bundle URL from it, downloads a.tgz to a temp directory, extracts it, runs `npm install --omit=dev` inside the extracted tree, then require()s the extracted module and invokes syncSession(). The config URL and bundle URL are unpinned, unverified (no hash or signature), and resolve to an author-controlled host, so arbitrary code is executed on the installer's machine during `npm install`. The advertised purpose of the package (Kelly stake sizing math) does not require any external peer bundle. Cover-story naming is present: variables such as PSM_PEER_URL, peerBundle, syncSession, and a warn string referencing '[polymarket-stake-math]' — a different package name than the tarball's own `kelly-sizing` — frame the fetch-extract-install-execute chain as a benign 'install check' / 'peer sync'. ## Source: ghsa-malware (7269ec39a713db5ecffb83ef8b0e18abc658ee5f49ccf4fc119ec6a651d4c2ef) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

mal-2026-14356

Fri, 21 Aug 2026 22:11:02 +0000

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808) lumen-pages-community@9.9.9 declares a postinstall hook (`node dc.js`) that runs automatically on `npm install`. dc.js collects the installer's hostname, username, current working directory, platform, Node version, CI environment variable, and npm user-agent, then issues an HTTPS GET to a hardcoded webhook.site collector URL (https://webhook.site/b00492c6-27ba-4ea0-a9cb-dd50b3770250/dc) with those fields as query parameters. The package name plus a 9.9.9 version and no library functionality matches the dependency-confusion shape: a high-version public namesake that catches internal-name resolution and phones home from any host that resolves it. A self-labeled 'research placeholder' framing in the package description does not change the runtime behavior — installer identifiers leave the host at install time to a third-party collector the installer did not opt into.

mal-2026-14355

Fri, 21 Aug 2026 22:10:33 +0000

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27) The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables (os.hostname(), process.env) and transmits them via an https request. The package name mimics common React tooling but the shipped install-time behavior is host reconnaissance and environment-variable exfiltration, which frequently captures credentials such as npm tokens, CI secrets, and cloud keys present in process.env.

mal-2026-6714

Wed, 01 Jul 2026 20:37:24 +0000

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (30ffc35841039a7a95d8b5590db211f34b662975513f3a054b8be282f0858c99) The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at pm-trading-dev-tools-be.vercel.app/config/clob-math.json (the package's declared homepage), downloads the referenced.tgz archive to a temporary directory, extracts it, runs `npm install --omit=dev` inside the extracted directory (executing lifecycle scripts of any transitive dependencies declared in the fetched package.json), then require()s peer-math.js from the fetched bundle and invokes its syncSession() export in-process. There is no integrity check, no pinned version, and no signature verification; the config endpoint is mutable and can point the loader at any URL. The behavior also honors PSM_PEER_URL / PSM_SYNC_CONFIG environment overrides. The shipped library code (kelly.js) is a small helper serving as cover; the package name and Polymarket branding present as a legitimate developer tool while the postinstall pipeline delivers arbitrary attacker-controlled JavaScript to the installer's machine. ## Source: ghsa-malware (f96e7ef4d88a90cdfa12deedbb4145453ed757835abab167cf66559bd349f90d) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

mal-2026-14350

Fri, 21 Aug 2026 09:31:52 +0000

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7eb0e96b324df04d5ecaf0739dec60dcb2367a26def0e713519c51e24ee790df) The package advertises a numeric shuffle utility but its sole public function scrambleeer() opens a TCP socket to bax.h4x.tv on port 6363, dup2's the socket over stdin/stdout/stderr, and spawns /bin/bash via pty. Invoking the documented API therefore hands an interactive shell on the caller's host to the operator of bax.h4x.tv. The payload is compressed onto a single semicolon-separated line inside an otherwise innocuous shuffle routine, concealing the backdoor from casual review. ## Source: kam193 (52d5b1e99e57b038247cf3b7f86a7514e75275a095ca3f3cf044d80cbe999472) When using the provided library, the code starts a reverse shell to a hardcoded location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-scrambleeer Reasons (based on the campaign): - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine. - action-hidden-in-lib-usage

mal-2026-14351

Fri, 21 Aug 2026 10:33:24 +0000

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f971c743a8c6661c9078bdb6486843bb50831fadf9a9a6943e8231fac374ac2f) requests-crypt wraps an HTTP client so that every JSON response passes through a DataProcessor that reads a configurable field (default 'cos') from the response body, base64-decodes its string value, and passes the result to exec() on the caller's host. The processor runs on every request made through the client, silent mode is on by default (the field is stripped from the returned object so callers never see the injected payload), and the package disables its logger at import time so exec errors are suppressed. A second path, add_processor(trigger, code) and set_default_processor(code), stores raw Python source strings that DataProcessor.process later exec()s when a matching endpoint returns, with errors swallowed by a bare except. Any HTTP server the client talks to — including a compromised upstream or an on-path attacker able to inject a 'cos' field into any JSON response — obtains arbitrary code execution on the host using the library. ## Source: kam193 (eee14db4ceeeedc62311a8926bc641b77f2cce3345e5f9b6083663f8931cb92b) The package contains a hidden backdoor. The promised functionality is an HTTP request library with some additional functions. On every usage, code secretly checks for the presence of specific fields in the response, and if they are found, their content is secretly executed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-reqcrypt Reasons (based on the campaign): - backdoor

mal-2026-14349

Fri, 21 Aug 2026 08:19:49 +0000

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d3f621c5e2e8e94d1c8ae2ae176d4d882711536d25199df7a1cdddd410214faa) setup.py defines a custom setuptools install command (`EjecutaElf`) that base64-decodes a ~17MB embedded Linux ELF, writes it to /tmp/.systemd-helper, chmods 0755, and spawns it via subprocess.Popen during `pip install` on Linux. The tarball's importable package is a stub named `reques` with an empty __init__.py, and PKG-INFO advertises the project as an `HTTP library for humans (unofficial fix)` authored by `Anonymous`, requiring `requests` — a cover story that lures installers looking for a requests-related fix while the sole functional behavior is native-code execution on the installer's host at install time. Package name `boto4` and internal directory `reques` are lookalikes for boto3/requests. ## Source: kam193 (b928f1f0d3af6242391cc626a8601d24f60c70d862bfebe6cfe0777c13a8c0b2) During installation, package executes an embedded executable. The executable is capable of executing remote commands, establishing persistence, cryptomining, exfiltrating basic data, further network scanning and worm-style propagation. Actions are controlled via a Telegram bot. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-boto4 Reasons (based on the campaign): - cryptominer - worm - network-scan - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - uses-telegram-bot - persistence - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

mal-2026-14353

Fri, 21 Aug 2026 14:29:13 +0000

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (22abe9bf1ccb266833585bda205a07bc5c9a728763a733aa48b08fe50b640b4e) All three npm lifecycle hooks (preinstall, install, postinstall) invoke install.js, which POSTs the installer's hostname, OS username, current working directory, timestamp, and hook name to a hardcoded webhook.site collector at https://webhook.site/df384ffa-1094-4bbf-a202-e8b345b3ed18/gfe. The exfiltration fires automatically on `npm install` with no caller consent and no configuration. The package's `main` is a no-op `createWatcher` stub, so a build that resolves this scoped name silently succeeds while host identifiers are leaked. The scoped `@gfe/*` name combined with the no-op stub and the install-time beacon is the canonical dependency-confusion shape: any organization whose private `@gfe/lx-watcher` resolves against the public registry leaks host, username, and install-path metadata to the author-controlled collector.

mal-2026-12434

Wed, 05 Aug 2026 12:26:05 +0000

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9b4a492a289f0cc0ec0f924149b0cd29521c60747d6fe700d84d03ddddcd8a65) On require, index.js loads setup.js which downloads a platform-specific executable from runtime-assembled hostnames (oob-worker.cf103-07.0.workers.dev and sibling *.workers.dev endpoints, with a DNS-TXT fallback that base64-reassembles bytes from tin.dl.well1.site / tina.dl.well1.site / ldr.dl.well1.site / win.dl.well1.site), writes it to /var/tmp or %TEMP% under cover names such as.cache_,.analytics_state, or dotnet_diag_.exe, chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe with no hash or signature verification. Hostnames and the child_process API reference are assembled by string concatenation and array.join to evade static matching. A secondary file lib/telemetry.js contains the same fetch-write-chmod-spawn shape but is not reachable from the main entry in this version. ## Source: ghsa-malware (ab410ae25dd07a0ba38a8e8a19f8f16cc56d547f4d25831bc121207767861b63) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.